5 ms·

Can someone comment on what assumptions those banks are permitted to make regarding names? E.g., can they assume that names can be expressed as a sequence of (

Can someone comment on what assumptions those banks are permitted to make regarding names? E.g., can they assume that names can be expressed as a sequence of (current) Unicode characters with some specific maximum length? Can they assume that names have no leading / trailing spaces?

mqus 5y ago
I think that it has to be reasonable. Assuming that your French-speaking target region has only names without accents is unreasonable. Assuming a maximum length of 200(?) utf8 codepoints(or even bytes) seems reasonable (defendable) in court. Same for leading/trailing spaces.
- temac 5y ago
  The longest personal name, according to the Guinness World Records, was 747 characters long, and happened to be in a latin alphabet. So I guess ~ 1000 bytes should be OK. Or even maybe what could be enough to fit 200 arbitrary utf8 codepoints, so 800 bytes. If you want to be safe maybe allow for up to 1000 arbitrary codepoints? :)
  - Smoosh 5y ago
    Oh man, I don't want to be in the queue behind that guy while he spells out his name to the clerk.
contravariant 5y ago
I'm somewhat wondering to what extent a bank is required to support storing the names natively. I mean something like "${name} spelled with an acute accent on the e" would be technically a correct description even if it is impractical to use. The GDPR does grant you the right to correct your personal information but doesn't specify how this information is represented. As far as I can tell the GDPR also doesn't grant the customer the right to have their name represented correctly on their bank pass (otherwise everyone with a long surname would require impractically long bank passes), the court only ruled that the inability of the bank to store the name correctly simply isn't an excuse.
mindcrime 5y ago
I wonder if there are any limits on this from the GDPR perspective? What if my name has 2^40 characters in it? Are companies required to support that? What if I change my name from whatever it is today (say, "Phillip") to a name that has 2^40 characters? Would the bank be required to accommodate that? etc..
- PeterisP 5y ago
  In civil law countries (after Brexit, 100% of EU is civil law) generally you can't change your name at will or by simply starting to use it, it usually requires asserting one of specific reasons that (in the eyes of the law) justify a name change, a request to authorities and their approval - which would be denied if you wanted to change your name to something that has 2^40 characters. If you did officially change your name to something interesting, I presume the bank would definitely have to accommodate it; but the restrictive part would be the process of actually changing your name.
- samus 5y ago
  The GDPR contains language that makes its provisions relative to the current techical state of the art. A bank can clearly not be expected to store all the 2^40 bytes of a person's name :)
tialaramex 5y ago
Probably reasonable assumptions. When you're not sure, assume the standard will be reasonableness, because that's what the law assumes when it isn't specified. So, you can make reasonable assumptions. What is reasonable will change, which is fine because the way courts figure out what's reasonable in some particular case is to either have the judge decide, or have a jury decide, and people change too. The nice thing about reasonableness is that you are equipped to make a first pass at judging it yourself, since you are presumably a reasonable person. If you need second guessing, have a team mate consider it, and, if you're worried that your collective idea of "reasonable" might be distorted in an important way, that'll be why your organisation probably encouraged diversity to avoid that. You might say, this seems awful because it isn't precise enough to say, implement it as a Javascript library. That's true, but intentional. Justice will necessarily involve such judgement calls, and trying to evade that by specifying everything precisely with no room for judgement is a bug not a feature.
PeterisP 5y ago
I believe that the main assumption they can make is that they can use the name on the ID forms issued by the government or, in case of foreign citizens, their passports. Due to history of international diplomacy, the general standard for passports expects that in addition to whatever script the country uses, they will also include the name of the person in English or French - so this is the key source of the problem, as for passports in e.g. Russian you will get an "English" name that you might use, however, you may get passports with names only in French, so you would have to support the English and French alphabets but perhaps not necessarily any others. Regarding trailing spaces etc, IMHO the standard would be "as shown in passport" i.e. trailing spaces definitely would not matter, but spaces and punctuation between words would (e.g. D'Artagnan as a name). I looked for but did not find any specific restrictions on name length. In general, the country will have regulations on what they accept as names in their official IDs, and again you may piggyback on other institutions - as long as you accept everything for which your government have issued documents, you should be fine; and if someone has an interesting case that requires changing the process, let that fight happen between them and the government first.

mqus 5y ago

I think that it has to be reasonable. Assuming that your French-speaking target region has only names without accents is unreasonable. Assuming a maximum length of 200(?) utf8 codepoints(or even bytes) seems reasonable (defendable) in court. Same for leading/trailing spaces.

temac 5y ago
The longest personal name, according to the Guinness World Records, was 747 characters long, and happened to be in a latin alphabet. So I guess ~ 1000 bytes should be OK. Or even maybe what could be enough to fit 200 arbitrary utf8 codepoints, so 800 bytes. If you want to be safe maybe allow for up to 1000 arbitrary codepoints? :)
- Smoosh 5y ago
  Oh man, I don't want to be in the queue behind that guy while he spells out his name to the clerk.

contravariant 5y ago

I'm somewhat wondering to what extent a bank is required to support storing the names natively. I mean something like "${name} spelled with an acute accent on the e" would be technically a correct description even if it is impractical to use. The GDPR does grant you the right to correct your personal information but doesn't specify how this information is represented. As far as I can tell the GDPR also doesn't grant the customer the right to have their name represented correctly on their bank pass (otherwise everyone with a long surname would require impractically long bank passes), the court only ruled that the inability of the bank to store the name correctly simply isn't an excuse.

mindcrime 5y ago

I wonder if there are any limits on this from the GDPR perspective? What if my name has 2^40 characters in it? Are companies required to support that? What if I change my name from whatever it is today (say, "Phillip") to a name that has 2^40 characters? Would the bank be required to accommodate that? etc..

PeterisP 5y ago
In civil law countries (after Brexit, 100% of EU is civil law) generally you can't change your name at will or by simply starting to use it, it usually requires asserting one of specific reasons that (in the eyes of the law) justify a name change, a request to authorities and their approval - which would be denied if you wanted to change your name to something that has 2^40 characters. If you did officially change your name to something interesting, I presume the bank would definitely have to accommodate it; but the restrictive part would be the process of actually changing your name.
samus 5y ago
The GDPR contains language that makes its provisions relative to the current techical state of the art. A bank can clearly not be expected to store all the 2^40 bytes of a person's name :)

tialaramex 5y ago

Probably reasonable assumptions. When you're not sure, assume the standard will be reasonableness, because that's what the law assumes when it isn't specified. So, you can make reasonable assumptions. What is reasonable will change, which is fine because the way courts figure out what's reasonable in some particular case is to either have the judge decide, or have a jury decide, and people change too. The nice thing about reasonableness is that you are equipped to make a first pass at judging it yourself, since you are presumably a reasonable person. If you need second guessing, have a team mate consider it, and, if you're worried that your collective idea of "reasonable" might be distorted in an important way, that'll be why your organisation probably encouraged diversity to avoid that. You might say, this seems awful because it isn't precise enough to say, implement it as a Javascript library. That's true, but intentional. Justice will necessarily involve such judgement calls, and trying to evade that by specifying everything precisely with no room for judgement is a bug not a feature.

PeterisP 5y ago

I believe that the main assumption they can make is that they can use the name on the ID forms issued by the government or, in case of foreign citizens, their passports. Due to history of international diplomacy, the general standard for passports expects that in addition to whatever script the country uses, they will also include the name of the person in English or French - so this is the key source of the problem, as for passports in e.g. Russian you will get an "English" name that you might use, however, you may get passports with names only in French, so you would have to support the English and French alphabets but perhaps not necessarily any others. Regarding trailing spaces etc, IMHO the standard would be "as shown in passport" i.e. trailing spaces definitely would not matter, but spaces and punctuation between words would (e.g. D'Artagnan as a name). I looked for but did not find any specific restrictions on name length. In general, the country will have regulations on what they accept as names in their official IDs, and again you may piggyback on other institutions - as long as you accept everything for which your government have issued documents, you should be fine; and if someone has an interesting case that requires changing the process, let that fight happen between them and the government first.